CVE-2023-4876

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4877

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

Hardcoded credentials

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

Hardcoded credentials

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4877 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4877 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4877 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4876 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4876

CVE-2023-4876 affects hamza417/inure (prior to build92). The root cause is improper validation of incoming intent.data in TTFViewerActivity, allowing content:// data to be opened via the app’s file provider and leading to exposure of sensitive files stored in external storage (e.g., Preferences.x...

CVE-2023-4876 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4876 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

PT-2023-30943 · Inure · Inure

Name of the Vulnerable Software and Affected Versions: inure versions prior to build92 Description: The issue concerns exposure of sensitive information to an unauthorized actor in the GitHub repository hamza417/inure. Recommendations: For versions prior to build92, update to build92 or later to...

CVE-2023-41316 HTML Injection with email in Tolgee

Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitati...

Outlook Hack: Microsoft Reveals How a Crash Dump Led to a Major Security Breach

Microsoft on Wednesday revealed that a China-based threat actor known as Storm-0558 acquired the inactive consumer signing key to forge tokens and access Outlook by compromising an engineer's corporate account. This enabled the adversary to access a debugging environment that contained informatio...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to execute arbitrary code.

The vulnerability of the XWiki Platform lies in its lack of access control mechanisms. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Ukraine's CERT Thwarts APT28's Cyberattack on Critical Energy Infrastructure

The Computer Emergency Response Team of Ukraine CERT-UA on Tuesday said it thwarted a cyber attack against an unnamed critical energy infrastructure facility in the country. The intrusion, per the agency, started with a phishing email containing a link to a malicious ZIP archive that activates th...

Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach

In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people...

Zero Redemption Amount in RdpxDecayingBonds Contract

Lines of code Vulnerability details Impact The redeem function, as described, checks whether the assets to be redeemed assets are not zero. This check is in place to ensure that a user isn't redeeming a non-zero amount of rdpxAmount tokens in exchange for zero assets. Such a check is essential to...

QakBot's Endgame: The Final Move Before the Takedown

QakBot's Endgame: The Final Move Before the Takedown By Daksh Kapur, Nico Paulo Yturriaga and Alfred Alvarado · September 06, 2023 Figure 1 Attribution at the bottom Qakbot, known under aliases like QBot, QuakBot, and Pinkslipbot, represents an intricately advanced malware strain that has...

Exposure of Sensitive Information to an Unauthorized Actor

AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use...